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LISTING OF CLAIMS 



4 
5 



LISTING OF THE CLAIMS 



6 



7 What is claimed, is: 
8 

9 1 . (currently amended) A method of monitoring events in a computer network, the method 

10 comprising: 



12 said computer network triggering said events, each event being provided with attribute values 

1 3 allocated to a given set of attributes of said each event. 
14 

15 simultaneo usly monitoring various event attributes versus the arrival time of each the events. 
16 

17 providing an event display with a cross plot having x and y coordinate axes, the x-axis presenting 

1 8 a time period and the y-axis presenting an attribute value range, 



20 determining a primary attribute of the events selected from the given set of attributes to be 

21 presented with its attribute values on the y-axis of the cross plot, 
22 

23 allocating a first display label to the events indicating the attribute values of the primary attribute, 

24 providing a pattern algorithm to detect whether an arrived event is part of the given pattern on the 

25 basis of a comparison of the attributes allocated to the given pattern and of the attributes assigned 

26 to the arrived event, providing a mapping algorithm to map any attribute value of an attribute 

27 selected from the given set of attributes onto the y-axis of the cross plot, 
28 

29 allocating a second display label to the events indicating the attribute values of the attributes 

30 being uncovered as part of the given pattern, 



11 



19 



31 
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1 plotting all the events arrived within the time period and including an attribute value allocated to 

2 the primary attribute into the cross plot with the first display label indicating the primary 

3 attribute, the position of the first display label of each event in the cross plot being determined on 

4 the basis of the attribute value of the primary attribute of the event and its anival time, and 
5 

6 plotting the all events arrived within the time period and being detected by means of the pattern 

7 algorithm as part of the given pattern into the cross plot with the second display label indicating 

8 the given pattern, the position of the second display label of each event in the cross plot being 

9 determined by the mapping algorithm on the basis of the attribute value of the attribute of the 
10 event being uncovered as part of the given pattern and its arrival tim e, and 

11 

12 viewing a secondary attribute of said each event t ogether with the primary attribute on said 

13 display. 
14 

15 2. (original) The method according to claim 1 , further comprising: 
16 

17 recording the attribute values and the arrival time of a new event, determining on the basis of the 

1 8 recorded attribute values of event whether or not the newly arrived event includes an attribute 

1 9 value of the primary attribute, and if the newly arrived event includes the attribute value for the 

20 primary attribute shifting the x-axis of the cross plot so that the time period being presented on 

2 1 the x-axis covers the arrival time of the event, and 
22 

23 plotting the event arrived within the shifted time period into the cross plot with the first display 

24 label indicating the primary attribute. 
25 

26 3. (original) The method according to claim 2 comprising the further steps of: 
27 

28 determining on the basis of the recorded attribute values of event whether or not the newly 

29 arrived event is part of the given pattern on the basis of a comparison of the attributes allocated 
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1 to the given pattern and of the attributes assigned to the arrived event, 
2 

3 if the newly anived event includes an attribute value of the given pattern adding the event to the 

4 previous events being detected as part of the given pattern, and 
5 

6 redrawing all the events being associated with given pattern in the cross plot. 
7 

8 4. (original) The method according to claim 3, further comprising: 
9 

10 if the newly arrived event does not include an attribute value of the given pattern, determining on 

1 1 the basis of the recorded attribute values of all previous arrived events by means of the pattern 

12 algorithm whether or not the newly arrived event is part of a new pattern on the basis of a 

13 comparison of the attributes allocated to the new pattern and of the attributes assigned to the 

14 arrived events; 
15 

16 if the newly arrived event forms together with previous recorded events the new pattern, 

1 7 allocating a third display label to the events indicating the attribute values of the attributes being 

1 8 uncovered as part of the new pattern; and 
19 

20 plotting the all events being detected by means of the pattern algorithm as part of the new pattern 

21 into the cross plot with the third display label indicating the new pattern, the position of the third 

22 display label of each event in the cross plot being determined by the mapping algorithm on the 

23 basis of the attribute value of the attribute of the event being uncovered as part of the new pattern 

24 and its arrival time. 
25 

26 5. (original) The method according to claim 1 , further comprising: 
27 

28 removing all the events including an attribute value allocated to the primary attribute from the 

29 cross plot, if a primary attribute to be presented with its attribute values on the y-axis of the cross 
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1 plot is changed, allocating a fourth display label to the events indicating the attribute values of 

2 the new primary attribute, and 
3 

4 plotting all the events arrived within the time period and including an attribute value allocated to 

5 the new primary attribute into the cross plot with the fourth display label indicating the new 

6 primary attribute, the position of the fourth display label of each event in the cross plot being 

7 determined on the basis of the attribute value of the primary attribute of the event and its arrival 

8 time. 
9 

10 6. (original) The method according to claim I comprising the further steps of plotting all 

1 1 attribute values recorded for an event with the respective display label into the cross plot if the 

12 event is selected by an operator, and displaying textual information associated with the selected 

1 3 event on the event display. 
14 

1 5 7. (original) The method according to claim 1 , wherein the pattern algorithm is suitable to 

16 perform multi-attribute pattern recognition. 
17 

1 8 8. (original) The method according to claim 1 , wherein each display label includes a specific 

1 9 color and/or a specific mark layout. 
20 

21 9. (original) The method according to claim 1, wherein all events being uncovered as part of the 

22 pattern are clustered by the corresponding display label. 
23 

24 1 0. (original) A computer program containing a program code to cany out the steps of the 

25 method of claim 1 , when the program code is running on a computer. 
26 

27 11. (original) A computer program containing a program code to cany out the steps of the 

28 method of claim 1 , said program code being stored on data carrier. 
29 
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1 12. (original) An event visualisation device for monitoring events in a computer network, the 

2 device comprising means to perform the steps of the method as cla imed in claim 1 . 
3 

4 13. (original) An article of manufacture comprising a computer usable medium having computer 

5 readable program code means embodied therein for causing monitoring of events in a computer 

6 network, the computer readable program code means in said article of manufacture comprising 

7 computer readable program code means for causing a computer to effect the steps of claim 1 . 
8 

9 14. (currently amended) A program storage device readable by machine, tangibly embodying a 

10 program of instructions executable by the machine to perform method steps for monitoring 

1 1 events in a computer network, said method steps comprising the steps o f claim V : 
12 

13 said computer network triggering sai d events, each event being provided with attribute values 

14 allocated to a given set of attributes of said each event, 
15 

16 simultaneously monitoring various event attributes versus the arrival time of each the events. 
17 

18 providing an event display wjtji a cross plot having x and v coordinate axes , the x-axis p resenting 

19 a time Period and the v-axis presenting an attrib ute value ran ^e, 
20 

21 detenatoing a primary attribute of t h e events selected from the given set of attributes tQ be 

22 presented with its attribu te values on the v-axis of the cross plot. 
23 

24 allocating ft first display label to th e events indicating the attribute values of the primary attribute. 

25 providing a pattern algorithm to de tect whether an arrived event is part of the given pattern on the 

26 basis of a comparison of the attribut es allocated to the given pattern and of the attributes assigned 

27 to the arrived event, providing a map ping algorithm to map any attribute value of an attribute 

28 selected from the given set of attributes onto the v-axis of the cross plot, 
29 
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1 allocating a second display label to the events indicating the attribute values of the attributes 

2 being uncovered as part of the given pattern. 
3 

4 Plotting all the events arrived within the time pe riod and including an attribute value allocated to 

5 the primary attribute into the cross plot with the first display label indicating the primary 

6 attribute, the position of the first display label of e a ch event in the cross plot being determined on 

7 the basis of the attribute value of the primary attribute of the event and its arrival time. 
8 

9 plotting the all events arrived within the time peri od and being detected bv means of the pattern 

10 algorithm as part of the given pattern into the crosy plot with the second display label indicating 

11 the given pattern, the position of th e second display label of each event in the cross plot being 

12 determined by the mapping algorithm on the bas is of the attribute value of the attribute of the 

13 event being uncovered as part of the given pattern and its arrival time, and 
14 

15 viewing a secondary attribute of sai d each event together with the primary attribute on said 

16 display . 
17 

IS 15. (original) A computer program product comprising a computer usable medium having 

1 9 computer readable program code means embodied therein for causing the event visualization 

20 device, the computer readable program code means in said computer program product 

2 1 comprising computer readable program code means for causing a computer to effect the 

22 functions of claim 12. 
23 

24 1 6. (previously presented) The method according to claim 1 , further comprising: 
25 

26 recording the attribute values and the arrival time of a new event, determining on the basis of the 

27 recorded attribute values of event whether or not the newly arrived event includes an attribute 

28 value of the primary attribute, and if the newly arrived event includes the attribute value for the 

29 primary attribute shifting the x-axis of the cross plot so that the time period being presented on 

30 the x-axis covers the arrival time of the event, 
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1 

2 plotting the event arrived within the shifted time period into the cross plot with the first display 

3 label indicating the primary attribute; 
4 

5 deteimining on the basis of the recorded attribute values of event whether or not the newly 

6 arrived event is part of the given pattern on the basis of a comparison of the attributes allocated 

7 to the given pattern and of the attributes assigned to the arrived event; 
8 

9 if the newly arrived event includes an attribute value of the given pattern adding the event to the 

1 0 previous events being detected as part of the given pattern; 
11 

1 2 redrawing all the events being associated with given pattern in the cross plot; 
13 

14 if the newly arrived event does not include an attribute value of the given pattern, determining on 

15 the basis of the recorded attribute values of all previous arrived events by means of the pattern 

16 algorithm whether or not the newly arrived event is part of a new pattern on the basis of a 

1 7 comparison of the attributes allocated to the new pattern and of the attributes assigned to the 

18 arrived events; 
19 

20 if the newly arrived event forms together with previous recorded events the new pattern, 

21 allocating a third display label to the events indicating the attribute values of the attributes being 

22 uncovered as part of the new pattern; and 
23 

24 plotting the all events being detected by means of the pattern algorithm as part of the new pattern 

25 into the cross plot with the third display label indicating the new pattern, the position of the third 

26 display label of each event in the cross plot being determined by the mapping algorithm on the 

27 basis of the attribute value of the attribute of the event being uncovered as part of the new pattern 

28 and its arrival time; 
29 

30 17. (previously presented) The method according to claim 16, further comprising; 
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1 

2 removing all the events including an attribute value allocated to the primary attribute from the 

3 cross plot, if a primary attribute to be presented with its attribute values on the y-axis of the cross 

4 plot is changed, allocating a fourth display label to the events indicating the attribute values of 

5 the new primary attribute, and 
6 

7 plotting all the events arrived within the time period and including an attribute value allocated to 

8 the new primary attribute into the cross plot with the fourth display label indicating the new 

9 primary attribute, the position of the fourth display label of each event in the cross plot being 
10 determined on the basis of the attribute value of the primary attribute of the event and its arrival 
U time. 

12 

13 18. (previously presented) The event visualization device for monitoring events in a computer 

14 network, according to claim 12, further comprising: 
15 

1 6 means for recording the attribute values and the arrival time of a new event, means for 

1 7 determining on the basis of the recorded attribute values of event whether or not the newly 

18 arrived event includes an attribute value of the primary attribute, and if the newly arrived event 

1 9 includes the attribute value for the primary attribute shifting the x-axis of ihe cross plot so that 

20 the time period being presented on the x-axi$ covers the arrival time of the event, 
21 

22 means for plotting the event arrived within the shifted time period into the cross plot with the 

23 first display label indicating the primary attribute; 
24 

25 means for determining on the basis of the recorded attribute values of event whether or not the 

26 newly arrived event is part of the given pattern on the basis of a comparison of the attributes 

27 allocated to the given pattern and of the attributes assigned to the arrived event; 
28 

29 means for adding for if the newly arrived event includes an attribute value of the given pattern 

30 adding the event to the previous events being detected as part of the given pattern; 

Application/Control Number; 10/798,070 9/28 
PAGE 9/28 * RCVD AT 4f10/2006 4:37:39 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/30 * DNIS:2738300 * CSID:8453523194 * DURATION (mm-ss):1 1-26 



04/10/2085 15:36 8453523194 



PAGE 



1 

2 means for redrawing all the events being associated with given pattern in the cross plot; 
3 

4 means for determining if the newly anived event does not include an attribute value of the given 

5 pattern, means for determining on the basis of the recorded attribute values of all previous 

6 arrived events by means of the pattern algorithm whether or not the newly anived event is part of 

7 a new pattern on the basis of a comparison of the attributes allocated to the new pattern and of 

8 the attributes assigned to the arrived events; 
9 

1 0 means fox allocating if the newly arrived event forms together with previous recorded events the 

1 1 new pattern, allocating a third display label to the events indicating the attribute values of the 

12 attributes being uncovered as part of the new pattern; and 
13 

14 means for plotting the all events being detected by means of the pattern algorithm as part of the 

1 5 new pattern into the cross plot with the third display label indicating the new pattern, the position 

16 of the third display label of each event in the cross plot being deiennined by the mapping 

17 algorithm on the basis of the attribute value of the attribute of the event being uncovered as part 

18 of the new pattern and its arrival time; 
19 

20 19. (previously presented) The event visualization device for monitoring events in a computer 

2 1 network, according to claim 1 8, further comprising: 
22 

23 means for removing all the events including an attribute value allocated to the primary attribute 

24 from the cross plot, if a primaiy attribute to be presented with its attribute values on the y-axis of 

25 the cross plot is changed, allocating a fourth display label to the events indicating the attribute 

26 values of the new primary attribute, and 
27 

28 means for plotting all the events arrived within the time period and including an attribute value 

29 allocated to the new primary attribute into the cross plot with the fourth display label indicating 

30 the new primary attribute, the position of the fourth display label of each event in the cross plot 
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1 being determined on the basis of the attribute value of the primary attribute of the event and its 

2 arrival time. 
3 

4 20. (currently amended) An article of manufacture comprising a compute r uaablc medium having 

5 computer readable program code means embodied theyem for causing monitoring of events in a 

6 computer network, the computer readable pr o gram code means in said article of manufacture 

7 comprising computer readable program code means for causing a computer to effect the steps of 

8 efeiflfr46 apparatus for monitoring events in a com puter network, the method comprising: 
9 

10 said computer networ k having means for triggering said events, each event being provided with 

11 attribute values allocated to a given set of attributes of said each event. 
12 

13 means for simu ltaneously monitoring various event attributes versus the arrival time of each the 

14 events, 
15 

16 means for providing an event display with a cross plot having x and v coordinate axes, the x-axis 

17 presenting a time peri od and the v-axis presenting an attribute value range , 
18 

19 means for determining a primary attribute of the events selected from the given set of attributes 

20 to be presented with its attribute values on the v-axis of the cross plot 
21 

22 means for allocating a first display label to the events indicating the attribute values of tft e 

23 primary attribute, providing a patter n algorithm to detect whether an arrived event is part of the 

24 given pattern on the ba sis of a comparison of the attributes allocated to the given pattern and of 

25 the attributes assigned to the arrived event, providing a mapping algorithm to map any attribute 

26 value of an attribute se lected from the given set of attributes onto the v-axis of the cross plot. 
27 

28 allocating a second dis play label to the events indicating the attribute values of the attributes 

29 bei ng uncovered as part of the given pattern. 
30 
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1 means for plotting all the events arrived within the time period and including an attribute value 

2 allocated to the primary attribute into the cross plot with the first display label indicating the 

3 Primary attribute, the position of the first display la bel of each event in the cross plot being 

4 determined on the basis of the attribu te value of the primary attribute of the event and its arrival 

5 time. 
6 

7 means for plotting the all events arrived within the time period and being detected bv means of 

8 the pattern algorithm as part of the gi ven nattern into the cross plot with the second display label 

9 indicating the given pattern, the p osition of the second display label of each event in the cross 

10 plot being determined bv the mapping algorithm on the basis of the attribute value of the attribute 

11 of the event being unco vered as part of the given pattern and its arrival time, and 
12 

13 means for viewing a , secondary attr ibute of said ea c h eve n t together with the primary attribute on 

14 said display. 
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